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WHAT IS CLAIMED IS: 




network usage recording system comprising: 
ollector including: 

an encapsulator for reading a plurality of network data records 
from a network data source and converting the network 
data records to a plurality of normalized metered events; 
aggregator for processing the normalized metered events to 
create aggregated normalized metered events; and 
dafy storage system, wherein the aggregator periodically stores 
the aggregated normalized metered events in the data 
storage system. 



2. The system of clVim 1, wherein the aggregator includes volatile memory 
for temporary storage of me aggregated normalized metered events. 

3. The system of claim K further comprising a configuration server in 
communication with the encapgulator, the aggregator and the data storage 
system, wherein the configuration server stores configuration data for the 
encapsulator, the aggregator, and me data storage system. 

4. The system of claim 3, wherein the configuration server communicates 
the configuration data to the encapsulate^, the aggregator and the data storage 
system at start-up. 



5. The system of claim 3, further comprising 
configuration server communicates with the en$ 
data storage system via the collector shell. 



a collector shell, wherein the 
psulator, the aggregator and the 



The system of claim 1, further comprising a query manager in 
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communication with the data storage system for querying the data storage 
system. 

7. \ The system of claim 6, wherein the query manager is in communication 
with tnfe data storage system via the aggregator. 

8. Thdsystem of claim 1, further comprising a statistics log, wherein the 
statistics log\s in communication with the encapsulated the aggregator and the 
data storage system for logging statistical data. 



10 9. The systernvpf claim 8, further comprising a collector operator, wherein 
the collector operatok communicates with the encapsulator, the aggregator, the 
data storage system and the statistics log to provide administrative access. 

10. The system of claim 1, wherein the encapsulator further includes a parser 
1 5 Ofor parsing network data received from the network data souce. 

1 1 . The system 1, wherein nje collector is configured as a network data 
collector. 

20 12. The system of claim 1, wherein the collector is configured as a correlator 
collector. 

13. The system of claim 1, wherein tlie collector is configured to perform 
additional levels of data reduction and consplidation of data stored in other 
25 collectors. 




A network usage recording system comprising: 
a collector system including: 
a collector shell; 
30 a query manager; 

an encapsulator; 
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an aggregator; and 
a data storage system. 



15. Trie system of claim 14, further comprising a configuration server in 
5 communication with the encapsulator, the aggregator and the data storage 

system. 

16. The syfetem of claim 15, wherein the configuration server communicates 
with the encapsulator, the aggregator and the data storage system via the 

10 collector shell. 

A method foXrecording network usage comprising the steps of: 
defining a collector including an encapsulator, an aggregator and a data 
storage system; 

1 5 operating the encapsulator to read a plurality of network data records 

from a network data source and convert the network data records 

to a plurality of normalized metered events; 
aggregating the plurality of normalized metered events to create a 

plurality of aggregated normalized metered events; and 
20 storing the aggregated noWalized metered events in the data storage 

system at periodic intervals. 

18. The method of claim 17, further comprising the steps of defining the 
aggregator to include volitale memory and storing the aggregated normalized 

25 metered events temporarily in the volitala memory. 

19. The method of claim 17, further comprising the step of defining a 
configuration server in communication with the encapsulator, the aggregator and 
the data storage system, and storing configuration data for the encapsulator, the 

30 aggregator and the data storage system in the configuration server. 
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20. \ The method of claim 19, further comprising the step of transferring the 
confiscation data to the encapsulator, the aggregator and the data storage 
system at start-up. 



5 21. TheVnethod of claim 1 7, further comprising the step of defining a query 
manager in communication with the data storage system for managing queries of 
the data storagie system. 

22. The methok of claim 17, further comprising the step of defining a 

10 statistics log in communication with the encapsulator, the aggregator and the 
data storage system, abd collecting statistics associated with the encapsulator, 
the aggregator and the <Wa storage system in the statistics log. 

23. The method of claim 17, further comprising the step of parsing the 
1 5 network data records from tHe usage data source read by the encapsulator. 
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A computer readable medium containing instructions for controlling a 
computer system to perform a method for recording network usage comprising 
the steps of: 

defining a collector including encapsulator, an aggregator and a data 
storage system; 

operating the encapsulator to read \ plurality of network data records 

from a network data source aW convert the network data records 

to a plurality of normalized metered events; 
aggregating the plurality of normalized metered events to create a 

plurality of aggregated normalizea\metered events; and 
storing the aggregated normalized metered events in the data storage 

system at periodic intervals. 
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